MS-203 - Microsoft 365 Messaging Mail Flow and Connectors Questions and Answers — Questions and Answers
Question 1: Your organization has a hybrid Exchange environment with mailboxes both on-premises and in Exchange Online. You need to ensure that all outbound email from Exchange Online to your on-premises servers is encrypted using TLS. Which of the following is the BEST way to achieve this?
- Create a mail flow rule to require TLS for messages sent to the on-premises domain.
- Configure a remote domain for the on-premises environment to require TLS.
- Create an outbound connector from Office 365 to your organization's email server and enforce TLS. (Correct answer)
- Enable STARTTLS on the on-premises Receive connector.
Correct answer: Create an outbound connector from Office 365 to your organization's email server and enforce TLS.
Connectors are specifically designed to manage mail flow between Microsoft 365 and external environments, such as on-premises servers or partner organizations. When creating an outbound connector, you can enforce the use of Transport Layer Security (TLS) to secure the connection, which is the most direct and appropriate method for this requirement.
Question 2: A company, Contoso, Ltd., wants to route all outbound email through a third-party cloud service for advanced compliance archiving before final delivery to the internet. As the messaging administrator, what combination of configurations is required in Exchange Online to implement this solution?
- An inbound connector from the partner organization and a mail flow rule.
- An outbound connector to the partner organization and a mail flow rule to redirect messages. (Correct answer)
- Only an outbound connector configured to route all mail through a smart host.
- A remote domain entry for '*' and an outbound connector.
Correct answer: An outbound connector to the partner organization and a mail flow rule to redirect messages.
To route outbound mail to a third-party service (a partner organization), you must first create an outbound connector that specifies the service's smart host address. Then, a mail flow rule is needed to identify all outbound messages and redirect them through that specific connector.
Question 3: Your company uses a third-party anti-spam service. The service filters all inbound mail and then forwards it to your Exchange Online tenant. You notice that legitimate emails from this service are sometimes being incorrectly marked as spam by Exchange Online Protection (EOP). Which of the following is the most effective way to prevent EOP from filtering mail that has already been scanned by the trusted third-party service?
- Create a mail flow rule to set the SCL to -1 for messages from the service's IP addresses. (Correct answer)
- Add the service's domain to the safe senders list in the anti-spam policy.
- Configure Enhanced Filtering for Connectors (Skip Listing) on the inbound connector from the service.
- Create a remote domain for the third-party service and disable spam filtering.
Correct answer: Create a mail flow rule to set the SCL to -1 for messages from the service's IP addresses.
Creating a mail flow rule to set the Spam Confidence Level (SCL) to -1 (Bypass spam filtering) for messages originating from the trusted service's IP addresses is the standard and recommended method. This tells EOP to trust the verdict of the upstream filter and deliver the message without further spam scanning.
Question 4: An administrator needs to configure mail flow for a newly added domain, `subsidiary.contoso.com`. The company's primary email domain is `contoso.com`. Some mailboxes for the new domain exist in Exchange Online, while others are still on a non-Exchange on-premises server. Email for any non-existent user at `subsidiary.contoso.com` should be routed to the on-premises server. What type of accepted domain should be configured for `subsidiary.contoso.com`?
- External Relay
- Authoritative
- Internal Relay (Correct answer)
- Non-Authoritative
Correct answer: Internal Relay
An Internal Relay (or Non-Authoritative) domain is used when recipients for that domain may exist in Exchange Online or on an external email system. Exchange Online will first check for a recipient in its own directory. If the recipient is not found, it will relay the email to the other email system, which is configured via a connector.
Question 5: Which of the following components in Exchange Online is used to control settings for messages sent TO external domains, such as managing out-of-office replies, delivery reports, and message formatting like TNEF (winmail.dat)?
- Accepted Domains
- Remote Domains (Correct answer)
- Connectors
- Mail Flow Rules
Correct answer: Remote Domains
Remote Domains are used to define settings for mail sent to domains outside of your Exchange Online organization. You can create a default remote domain entry ('*') for all external domains and specific entries for particular domains to control settings like allowing automatic replies (out-of-office), message format (Rich Text, HTML, Plain Text), and character sets.
Question 6: A developer needs to configure a line-of-business application running on an on-premises server to send email notifications to external recipients using the company's domain. The application does not support modern authentication. The administrator wants to securely allow this relay through Microsoft 365. Which of the following is the most appropriate configuration?
- Configure an outbound connector from Office 365 to a partner organization.
- Use SMTP AUTH with a licensed mailbox and basic authentication.
- Create an inbound connector of the type 'On-premises' that is scoped to the application server's public IP address. (Correct answer)
- Configure a mail flow rule to allow relay from the application's email address.
Correct answer: Create an inbound connector of the type 'On-premises' that is scoped to the application server's public IP address.
For SMTP relay from on-premises devices or applications, the recommended and secure method is to create an inbound connector. This connector should be configured to accept mail from your organization's email server and be restricted by the specific public IP address(es) of the sending server or application. This allows relay without requiring authentication on the application itself.
MS-203 - Microsoft 365 Messaging Mail Flow and Connectors Questions and Answers
Your organization has a hybrid Exchange environment with mailboxes both on-premises and in Exchange Online.
You need to ensure that all outbound email from Exchange Online to your on-premises servers is encrypted using TLS.
Which of the following is the BEST way to achieve this?